When it comes to the security problems with WordPress plugins, as well as many other problems with WordPress, the project’s lack of proper governance is a key problem. In addition to Matt Mullenweg, the only person that appears to have an oversight role for the project has been the Executive Director of WordPress. That hasn’t produced good results.

While not disclosed by Matt Mullenweg when he announced the position, the first holder of the position was the head of the open source division of Automattic, Matt Mullenweg’s company. The obvious conflict of interest might explain why that person never released the conflict of interest policy they promised for over a year. That person held the position from 2019 until September, when Matt Mullenweg’s offered a buyout to Automattic employees after his extortion campaign against WP Engine went public. They unsurprisingly operated largely in line with what you would expect from someone that is an employee of Automattic who happens to hold that title.

Under the slightly different title, he announced a new Executive Director of WordPress.org in October. He disclosed that person had previously worked at Automattic on WordPress.com, to provide a fig leaf they had some connection with WordPress. He didn’t disclose they were re-hired by Automattic to take the role. What exactly they were doing in the role so far isn’t entirely clear, but it doesn’t appear to have led to any positive changes (or even an answer for what should be simple questions).

Yesterday, Automattic announced that they were only going to provide 45 hours of time to the WordPress project as part of Matt Mullenweg’s continued temper tantrum caused by WP Engine’s failing to give in to his extortion. We were curious how that is supposed to be compatible with that person holding that role. Before this change, they were claiming to be sponsored by Automattic to spend 40 hours a week on the project. That sounds reasonable, based on what their job is supposed to be. If they continued that way, that would leave Automattic with only 5 hours among anyone else. How would that be addressed? The solution is now they are claiming to spend only 5 hours a week, and that it isn’t sponsored by Automattic.

How is WordPress supposed to operate with an Executive Director that only spends an hour a business day on the project? The community would likely support, monetarily and otherwise, replacing them with an independent Executive Director focused on the project, but that would lessen Matt Mullenweg’s control of the project.

Update 1/10: The Executive Director left this comment on a post about the events programing being slowed down:

Thank you, Juan. Absolutely, the community commitment to WordCamps and WordPress will shine through. Though things may slow, they will move forward. I appreciate all the dedication of the contributors as we continue to navigate this situation.